CVE-2023-32186

A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32186	Issue Tracking Vendor Advisory
https://github.com/rancher/rke2/security/advisories/GHSA-p45j-vfv5-wprq	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:suse:rancher_rke2::::::::
	cpe:2.3:a:suse:rancher_rke2::::::::
	cpe:2.3:a:suse:rancher_rke2::::::::
	cpe:2.3:a:suse:rancher_rke2::::::::
	cpe:2.3:a:suse:rancher_rke2:1.28.1\+rke2r1:rc1::::::
	cpe:2.3:a:suse:rancher_rke2:1.28.1\+rke2r1:rc2::::::

History

22 Sep 2023, 02:00

Type	Values Removed	Values Added
References	~~(MISC) https://github.com/rancher/rke2/security/advisories/GHSA-p45j-vfv5-wprq -~~	(MISC) https://github.com/rancher/rke2/security/advisories/GHSA-p45j-vfv5-wprq - Mitigation, Vendor Advisory
References	~~(MISC) https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32186 -~~	(MISC) https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32186 - Issue Tracking, Vendor Advisory
CPE		cpe:2.3:a:suse:rancher_rke2:1.28.1\+rke2r1:rc2:::::: cpe:2.3:a:suse:rancher_rke2:1.28.1\+rke2r1:rc1:::::: cpe:2.3:a:suse:rancher_rke2::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
First Time		Suse rancher Rke2 Suse

19 Sep 2023, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-19 10:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-32186

Mitre link : CVE-2023-32186

CVE.ORG link : CVE-2023-32186

JSON object : View

Products Affected

suse

rancher_rke2

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2023-32186", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-09-19T10:15:13.357", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32186", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "meissner@suse.de"}, {"url": "https://github.com/rancher/rke2/security/advisories/GHSA-p45j-vfv5-wprq", "tags": ["Mitigation", "Vendor Advisory"], "source": "meissner@suse.de"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service.\nThis issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1.\n\n"}, {"lang": "es", "value": "Una vulnerabilidad de Asignaci\u00f3n de Recursos sin L\u00edmites o Throttling en SUSE RKE2 permite a los atacantes con acceso al puerto apiserver/supervisor de servidores K3s (TCP 6443) causar denegaci\u00f3n de servicio. Este problema afecta a RKE2: desde la versi\u00f3n 1.24.0 antes de 1.24.17+rke2r1, desde la versi\u00f3n v1.25.0 antes de v1.25.13+rke2r1, desde la versi\u00f3n v1.26.0 antes de v1.26.8+rke2r1, desde la versi\u00f3n v1.27.0 antes de v1.27.5+rke2r1, desde la versi\u00f3n v1.28.0 antes de v1.28.1+rke2r1."}], "lastModified": "2023-09-22T02:00:06.313", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:suse:rancher_rke2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "195E8F96-931F-438D-BB2B-C2F06E15FF88", "versionEndExcluding": "1.24.17\\+rke2r1", "versionStartIncluding": "1.24.0\\+rke2r1"}, {"criteria": "cpe:2.3:a:suse:rancher_rke2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C4538F6-9D57-42C2-A8AD-3A60092DE90A", "versionEndExcluding": "1.25.13\\+rke2r1", "versionStartIncluding": "1.25.0\\+rke2r1"}, {"criteria": "cpe:2.3:a:suse:rancher_rke2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8276EC2F-6723-41E8-87FC-4960B1B889B1", "versionEndExcluding": "1.26.8\\+rke2r1", "versionStartIncluding": "1.26.0\\+rke2r1"}, {"criteria": "cpe:2.3:a:suse:rancher_rke2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0DABB36B-6677-485A-B93A-85EC6F0F5870", "versionEndExcluding": "1.27.5\\+rke2r1", "versionStartIncluding": "1.27.1\\+rke2r1"}, {"criteria": "cpe:2.3:a:suse:rancher_rke2:1.28.1\\+rke2r1:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "509E3AE9-B776-40AD-9BC5-722A05C3718E"}, {"criteria": "cpe:2.3:a:suse:rancher_rke2:1.28.1\\+rke2r1:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33ACA7A8-9A6B-4EC1-B4BC-C554533592CC"}], "operator": "OR"}]}], "sourceIdentifier": "meissner@suse.de"}